Cannot get Apache2 mod_auth_openidc to work - Forbidden (Origin checking failed - https://web.company does not match any trusted origins.)

**Describe your question/**
I am trying to lockdown the static Apache2 landing page to be accessible after authentication only and therefore installed mod_auth_openidc. I basically took the example configuration for [https://integrations.goauthentik.io/monitoring/observium/](https://integrations.goauthentik.io/monitoring/observium/) and applied it to my case. When trying to authenticate I run into CSRF errors and I'm not sure on how to proceed from here.

Does anyone have any idea how to proceed from here? I'm out of ideas, since Authentik is otherwise working fine for my Lab applications with native OpenIDC support (like Bookstack). This is the first time I encounter this issue.

Any hints would be greatly appreciated. Thanks in advance and have a wonderful day.

**Relevant info**
Used software and versions:
```
Ubuntu 24.04.3 LTS
Apache/2.4.58
libapache2-mod-auth-openidc Version: 2.4.15.1-1ubuntu0.1
```

Apache2 configuration:
```

ServerName web.company
ServerAdmin webmaster@localhost
DocumentRoot /var/www/html

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

OIDCProviderMetadataURL https://auth.company/application/o/web-company/.well-known/openid-configuration

OIDCClientID
OIDCClientSecret
OIDCCryptoPassphrase

OIDCRedirectURI https://web.company/redirect_uri
OIDCCookieDomain web.company
OIDCXForwardedHeaders X-Forwarded-Host X-Forwarded-Proto
OIDCPathScope "openid email profile"
OIDCRemoteUserClaim preferred_username ^(.*)$ $1@authentik

OIDCProviderAuthRequestMethod POST
OIDCStateMaxNumberOfCookies 5 true
OIDCRemoteUserClaim email

AuthType openid-connect
Require valid-user

ServerName web.company
SSLCertificateFile /etc/letsencrypt/live/web.company/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/web.company/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf

```

**Screenshots**
Not applicable

**Logs**
```
server-1 | {"event": "Forbidden (Origin checking failed - https://web.company does not match any trusted origins.): /application/o/authorize/", "level": "warning", "logger": "django.security.csrf", "timestamp": "2025-08-29T13:52:48.736307"}
server-1 | {"auth_via": "session", "domain_url": "auth.company", "event": "/application/o/authorize/", "host": "auth.company", "level": "info", "logger": "authentik.asgi", "method": "POST", "pid": 358875, "remote": "", "request_id": "ba089c5d9a4f4601834c32b728c8ce0c", "runtime": 44, "schema_name": "public", "scheme": "https", "status": 403, "timestamp": "2025-08-29T13:52:48.739775", "user": "", "user_agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0"}
```

**Version and Deployment (please complete the following information):**
- authentik version: 2025.8.1
- Deployment: docker-compose

Start with the Apache2 VirtualHost configuration and the linked Authentik Observium integration example, then inspect the POST to /application/o/authorize/ alongside the recorded CSRF error. Done means the protected landing page authenticates successfully without the Origin checking failure.

Written by the indexing model from the issue text.